@phnx-labs/agents-cli 1.20.51 → 1.20.53

package/dist/commands/exec.js

@@ -327,7 +327,7 @@ export function registerRunCommand(program) {
                 process.exit(1);
             }
             const backend = typeof options.lease === 'string' ? options.lease : undefined;
-            const { detectSignedInRuntimes, pickRuntimes } = await import('../lib/crabbox/runtimes.js');
+            const { detectSignedInRuntimes, pickRuntimes, resolveClaudeCredentialsBlob } = await import('../lib/crabbox/runtimes.js');
             const { leaseAndRun } = await import('../lib/crabbox/lease.js');
             const { confirm } = await import('@inquirer/prompts');
             const detected = await detectSignedInRuntimes();
@@ -344,30 +344,109 @@ export function registerRunCommand(program) {
                 return `${d?.label ?? id}${d?.email ? ` (${d.email})` : ''}`;
             })
                 .join(', ');
+            // Claude ships its OAuth token (not just the .claude.json config) — name it
+            // explicitly so the consent covers the actual credential transferred.
+            const whatShips = runtimes.includes('claude') ? 'credentials + Claude OAuth token' : 'credentials';
             const ok = await confirm({
-                message: `Copy credentials for ${names} to a disposable cloud box, run there, then destroy it?`,
+                message: `Copy ${whatShips} for ${names} to a disposable cloud box, run there, then destroy it?`,
                 default: false,
             });
             if (!ok) {
                 console.error(chalk.yellow('Aborted — no credentials pushed, no box leased.'));
                 process.exit(1);
             }
+            // Read the Claude OAuth token from the local Keychain (silent) so it can be
+            // written to ~/.claude/.credentials.json on the box — otherwise Claude boots
+            // "Not logged in". Consent above already covered this transfer.
+            let claudeCredentialsJson = null;
+            if (runtimes.includes('claude')) {
+                const claudeEmail = detected.find((d) => d.id === 'claude')?.email ?? null;
+                claudeCredentialsJson = await resolveClaudeCredentialsBlob({ preferEmail: claudeEmail });
+                if (!claudeCredentialsJson) {
+                    console.error(chalk.yellow('Warning: could not read the local Claude OAuth token — the box may come up "Not logged in".'));
+                }
+            }
+            // Progress UI. A self-throttled spinner (NOT ora — see progress.ts) covers
+            // the otherwise-silent provisioning + box-setup phases; the agent's own
+            // output then prints verbatim. The router splits the crabbox stream at the
+            // box-side marker. Rule: only ONE spinner phase is active at a time, and no
+            // other output is written to stderr while it spins — so it can never storm.
+            const { createLeaseOutputRouter, createSpinner } = await import('../lib/crabbox/progress.js');
+            const agentName = agentSpec.split('@')[0];
+            const spinner = createSpinner({ stream: process.stderr });
+            let warmupTimer;
+            const stopTimer = () => { if (warmupTimer) {
+                clearInterval(warmupTimer);
+                warmupTimer = undefined;
+            } };
+            const fit = (s) => {
+                const w = Math.max(20, (process.stderr.columns || 80) - 24);
+                return s.length > w ? s.slice(0, w - 1) + '…' : s;
+            };
+            const router = createLeaseOutputRouter({
+                // Setup lines only ever update spinner text (no direct stderr writes),
+                // so the spinner stays the single writer during the setup phase.
+                onSetupLine: (line) => spinner.update(`Setting up box — ${fit(line)}`),
+                onAgentChunk: (chunk) => {
+                    // First agent byte: stop the setup spinner, THEN stream to stdout.
+                    if (spinner.active)
+                        spinner.stopAndPersist('✔', chalk.gray(`Box provisioned — ${agentName} output:`));
+                    process.stdout.write(chunk);
+                },
+            });
             try {
                 const { exitCode, box, toreDown } = await leaseAndRun({
-                    agent: agentSpec.split('@')[0],
+                    agent: agentName,
                     prompt,
                     mode: options.mode,
                     model: options.model,
                     backend,
                     runtimes,
                     detected,
+                    claudeCredentialsJson,
                     secretsBundle: process.env.AGENTS_LEASE_SECRETS_BUNDLE,
                     keep: options.keepBox,
+                    onData: (chunk) => router.push(chunk),
+                    onPhase: (phase) => {
+                        if (phase.kind === 'warmup') {
+                            const label = `Leasing a ${phase.backend ?? 'hetzner'} box`;
+                            spinner.start(`${label}…`);
+                            const t0 = Date.now();
+                            warmupTimer = setInterval(() => spinner.update(`${label}… (${Math.round((Date.now() - t0) / 1000)}s)`), 1000);
+                        }
+                        else if (phase.kind === 'ready') {
+                            stopTimer();
+                            spinner.stopAndPersist('✔', `Box ${phase.box.slug} ready${phase.box.ip ? ` (${phase.box.ip})` : ''} · ${Math.round(phase.elapsedMs / 1000)}s`);
+                            spinner.start('Setting up box…');
+                        }
+                        else if (phase.kind === 'teardown') {
+                            if (spinner.active)
+                                spinner.stop();
+                        }
+                    },
                 });
+                router.end();
+                stopTimer();
+                if (spinner.active)
+                    spinner.stop();
+                // Safety net: if setup failed before the agent ever ran, the setup log
+                // was only shown as transient spinner text — surface it so the error is
+                // diagnosable.
+                if (exitCode !== 0 && !router.sawAgent()) {
+                    const log = router.setupLines();
+                    if (log.length)
+                        process.stderr.write(chalk.dim(log.join('\n')) + '\n');
+                }
                 console.error(chalk.gray(toreDown ? `Box ${box.slug} destroyed.` : `Box ${box.slug} kept${box.ip ? ` (${box.ip})` : ''}. Stop it: crabbox stop ${box.slug}`));
                 process.exit(exitCode === null ? 1 : exitCode);
             }
             catch (err) {
+                stopTimer();
+                if (spinner.active)
+                    spinner.stopAndPersist('✖', chalk.red('Lease failed'));
+                const log = router.setupLines();
+                if (log.length && !router.sawAgent())
+                    process.stderr.write(chalk.dim(log.join('\n')) + '\n');
                 console.error(chalk.red(err.message));
                 process.exit(1);
             }

package/dist/commands/factory.js

@@ -5,6 +5,7 @@ import * as path from 'path';
 import { homedir } from 'os';
 import { betaEnableHint, isBetaEnabled } from '../lib/beta.js';
 import { insertTask } from '../lib/cloud/store.js';
+import { emit } from '../lib/events.js';
 function requireFactoryUrl() {
     const url = process.env.FACTORY_FLOOR_URL;
     if (!url) {
@@ -79,6 +80,13 @@ Examples:
             createdAt: now,
             updatedAt: now,
         });
+        emit('cloud.dispatch', {
+            module: 'factory',
+            taskId: result.cloud_execution_id,
+            ref,
+            linear_identifier: result.linear_identifier,
+            status: 'queued',
+        });
         console.log(chalk.green(`Submitted ${result.linear_identifier} (${result.label})`));
         console.log(`  ticket       ${result.ticket_id}`);
         console.log(`  execution    ${result.cloud_execution_id}`);

package/dist/commands/feed.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `agents feed` -- list open blocks (decisions agents are waiting on).
+ *
+ * Aggregates block records from the local feed store and, with --host, from
+ * reachable remote hosts via SSH passthrough. Each block carries enough
+ * identity for `agents message` to route a reply back to the right agent.
+ *
+ * Default view groups by **outcome** (ticket / PR / worktree / Unassigned) so
+ * an operator sees dozens of deliverables, not ~1,100 agents. Pass `--flat`
+ * for the legacy per-agent list.
+ */
+import type { Command } from 'commander';
+import { type OpenBlock } from '../lib/feed.js';
+import { type OutcomeGroup, type SessionOutcomeHint } from '../lib/feed-outcome.js';
+export declare const FEED_NO_FANOUT_ENV = "AGENTS_FEED_LOCAL";
+export declare function parseRemoteFeed(stdout: string, machine: string): OpenBlock[];
+/** Merge local and remote rows, keeping the first copy of a host/session block. */
+export declare function mergeFeedBlocks(...groups: OpenBlock[][]): OpenBlock[];
+export declare function shouldIncludeLocalFeed(hosts: string[] | undefined, self: string): boolean;
+export declare function remoteFeedHostsToDial(hosts: string[] | undefined, self: string): string[] | undefined;
+/** Human summary line for one outcome rollup. */
+export declare function formatOutcomeHeader(group: OutcomeGroup): string;
+/** Map active sessions into the lightweight hints outcome enrichment needs. */
+export declare function sessionHintsFromActive(sessions: Array<{
+    sessionId?: string;
+    agentId?: string;
+    ticket?: {
+        id?: string;
+    };
+    pr?: {
+        url?: string;
+        number?: number;
+    };
+    worktree?: {
+        slug?: string;
+    };
+}>): SessionOutcomeHint[];
+export declare function registerFeedCommand(program: Command): void;

package/dist/commands/feed.js

@@ -0,0 +1,274 @@
+import chalk from 'chalk';
+import { ensureFeedPublishHook, listBlocks, recordNotified } from '../lib/feed.js';
+import { enrichBlocksFromSessions, groupBlocksByOutcome, isUnambiguousOutcomeAnswer, openBlocksForOutcome, stampBlockOutcomes, } from '../lib/feed-outcome.js';
+import { classifyBlock, filterBlocksForFeed, suppressionDigest, } from '../lib/ask-classifier.js';
+import { machineId, normalizeHost } from '../lib/machine-id.js';
+import { relTime } from '../lib/format.js';
+import { gatherRemoteAgentsJson } from '../lib/remote-agents-json.js';
+import { loadPolicy, applyPolicyToBlock, isPhoneUrgent } from '../lib/feed-policy.js';
+import { notifyUrgentBlock } from '../lib/notify.js';
+import { gcMailbox } from '../lib/mailbox-gc.js';
+import { getActiveSessions } from '../lib/session/active.js';
+import { mailboxIdForActiveSession } from '../lib/mailbox-target.js';
+export const FEED_NO_FANOUT_ENV = 'AGENTS_FEED_LOCAL';
+export function parseRemoteFeed(stdout, machine) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(parsed))
+        return [];
+    const blocks = [];
+    for (const item of parsed) {
+        if (!item || typeof item !== 'object' || Array.isArray(item))
+            continue;
+        const block = item;
+        if (!block.blockId || !block.sessionId || !block.mailboxId || !block.questions?.length)
+            continue;
+        blocks.push({ ...block, host: machine });
+    }
+    return blocks;
+}
+/** Merge local and remote rows, keeping the first copy of a host/session block. */
+export function mergeFeedBlocks(...groups) {
+    const byIdentity = new Map();
+    for (const block of groups.flat()) {
+        const key = `${normalizeHost(block.host)}:${block.blockId}`;
+        if (!byIdentity.has(key))
+            byIdentity.set(key, block);
+    }
+    return [...byIdentity.values()].sort((a, b) => Date.parse(b.ts) - Date.parse(a.ts));
+}
+function hostToken(host) {
+    return normalizeHost(host.split('@').pop() || host);
+}
+export function shouldIncludeLocalFeed(hosts, self) {
+    return !hosts?.length || hosts.some((host) => hostToken(host) === self);
+}
+export function remoteFeedHostsToDial(hosts, self) {
+    if (!hosts?.length)
+        return undefined;
+    return hosts.filter((host) => hostToken(host) !== self);
+}
+function renderBlock(b, localHost, indent = '') {
+    const host = b.host !== localHost ? chalk.yellow(` [${b.host}]`) : '';
+    const runtime = chalk.gray(b.runtime);
+    const age = chalk.gray(relTime(b.ts));
+    const cls = b.blockClass ? chalk.gray(`(${b.blockClass})`) : '';
+    const consequence = b.consequence && b.consequence !== 'normal' ? chalk.red(`[${b.consequence}]`) : '';
+    const cost = b.costOfDelay ? chalk.gray(`cost:${b.costOfDelay}`) : '';
+    console.log(`${indent}${chalk.cyan(b.mailboxId)}${host}  ${runtime}  ${age}  ${cls} ${consequence} ${cost}`.trimEnd());
+    for (const question of b.questions) {
+        const header = question.header ? chalk.gray(`[${question.header}] `) : '';
+        console.log(`${indent}  ${header}${question.text}`);
+        if (question.options?.length) {
+            for (let i = 0; i < question.options.length; i++) {
+                const o = question.options[i];
+                const desc = o.description ? chalk.gray(` -- ${o.description}`) : '';
+                console.log(`${indent}    ${chalk.dim(`${i + 1}.`)} ${o.label}${desc}`);
+            }
+        }
+    }
+    if (b.ticket || b.pr || b.worktreeSlug) {
+        const meta = [b.ticket, b.pr, b.worktreeSlug].filter(Boolean).join('  ');
+        console.log(`${indent}  ${chalk.gray(meta)}`);
+    }
+    if (b.answer) {
+        const verified = b.answer.verified ? chalk.green('✓') : chalk.yellow('?');
+        const who = b.answer.answeredFrom + (b.answer.answeredBy ? ` (${b.answer.answeredBy})` : '');
+        console.log(`${indent}  ${chalk.green('answered')} by ${who} ${verified}`);
+    }
+    if (b.parkedAt) {
+        console.log(`${indent}  ${chalk.red('hard-parked')} ${relTime(b.parkedAt)}`);
+    }
+    if (b.defaultedAt) {
+        console.log(`${indent}  ${chalk.yellow('defaulted')} ${relTime(b.defaultedAt)}`);
+    }
+    if (b.receipts && b.receipts.length > 0) {
+        const latest = b.receipts[b.receipts.length - 1];
+        console.log(`${indent}  ${chalk.dim('delivery:')} ${latest.status}`);
+    }
+    if (b.continuedAt) {
+        console.log(`${indent}  ${chalk.green('continued')} ${relTime(b.continuedAt)}`);
+    }
+    if (b.notifiedAt) {
+        console.log(`${indent}  ${chalk.dim('notified')} ${relTime(b.notifiedAt)}`);
+    }
+    if (!b.answer && !b.parkedAt) {
+        console.log(`${indent}  ${chalk.dim('reply:')} agents message ${b.mailboxId} "<answer>"`);
+    }
+    console.log();
+}
+/** Human summary line for one outcome rollup. */
+export function formatOutcomeHeader(group) {
+    const { agents, open, answered, parked } = group.counts;
+    const parts = [
+        `${agents} agent${agents === 1 ? '' : 's'}`,
+        open > 0 ? `${open} needs you` : null,
+        answered > 0 ? `${answered} answered` : null,
+        parked > 0 ? `${parked} parked` : null,
+    ].filter(Boolean);
+    return `${group.outcome.label} · ${parts.join(' · ')}`;
+}
+function renderOutcomeGroup(group, localHost) {
+    console.log(chalk.bold(formatOutcomeHeader(group)));
+    if (isUnambiguousOutcomeAnswer(group) && openBlocksForOutcome(group).length > 1) {
+        const ids = openBlocksForOutcome(group).map((b) => b.mailboxId).join(', ');
+        console.log(chalk.dim(`  same question on ${openBlocksForOutcome(group).length} agents — fan-out safe: ${ids}`));
+    }
+    for (const b of group.blocks) {
+        renderBlock(b, localHost, '  ');
+    }
+}
+/** Map active sessions into the lightweight hints outcome enrichment needs. */
+export function sessionHintsFromActive(sessions) {
+    return sessions.map((s) => ({
+        sessionId: s.sessionId,
+        agentId: s.agentId,
+        // Same precedence as mailboxIdForActiveSession (agentId ?? sessionId).
+        mailboxId: s.agentId ?? s.sessionId,
+        ticketId: s.ticket?.id,
+        prNumber: s.pr?.number,
+        prUrl: s.pr?.url,
+        worktreeSlug: s.worktree?.slug,
+    }));
+}
+export function registerFeedCommand(program) {
+    program
+        .command('feed')
+        .description('List open blocks -- decisions agents are waiting on (grouped by outcome)')
+        .option('--json', 'Output as JSON (each block stamped with its outcome + ask class)')
+        .option('--flat', 'List one block per agent instead of grouping by outcome')
+        .option('--all', 'Include stalls/FYIs that policy would suppress (default: hide them)')
+        .option('--local', 'Only this machine -- skip the cross-machine SSH fan-out')
+        .option('-H, --host <target...>', 'Scope to remote machine(s) over SSH; repeatable')
+        .option('--device <target...>', 'Alias for --host; repeatable')
+        .option('--dispatch', 'Run stall suppression + default-on-no-answer policy and urgent notifications')
+        .action(async (opts) => {
+        if (opts.device?.length)
+            opts.host = [...(opts.host ?? []), ...opts.device];
+        const self = machineId();
+        const includeLocal = shouldIncludeLocalFeed(opts.host, self);
+        const setupWarnings = [];
+        if (includeLocal) {
+            const hookInstall = ensureFeedPublishHook();
+            if (hookInstall.error) {
+                setupWarnings.push(hookInstall.error);
+            }
+            else {
+                const [{ iterHooksCapableVersions, parseHookManifest, registerHooksToSettings }, { getVersionHomePath }] = await Promise.all([
+                    import('../lib/hooks.js'),
+                    import('../lib/versions.js'),
+                ]);
+                const manifest = parseHookManifest({ warn: false });
+                for (const { agent, version } of iterHooksCapableVersions({ agent: 'claude' })) {
+                    const result = registerHooksToSettings(agent, getVersionHomePath(agent, version), manifest);
+                    if (result.errors.length > 0) {
+                        setupWarnings.push(`${agent}@${version}: ${result.errors.join('; ')}`);
+                    }
+                }
+            }
+        }
+        // Active sessions feed both the GC sweep and outcome enrichment (ticket/PR).
+        let sessions = [];
+        if (includeLocal) {
+            sessions = await getActiveSessions();
+        }
+        if (opts.dispatch && includeLocal) {
+            // Liveness sweep: drop messages to dead agents and retire stale blocks
+            // before we render the feed.
+            const activeBoxIds = new Set(sessions.map(mailboxIdForActiveSession).filter((id) => !!id));
+            const gcResult = gcMailbox(activeBoxIds);
+            if (gcResult.blocksRemoved > 0 || gcResult.messagesDroppedDead > 0) {
+                console.log(chalk.yellow(`gc: ${gcResult.messagesDroppedDead} dead messages, ${gcResult.blocksRemoved} stale blocks removed`));
+            }
+        }
+        const localBlocks = includeLocal ? listBlocks() : [];
+        let blocks = localBlocks;
+        const forceLocal = opts.local === true || process.env[FEED_NO_FANOUT_ENV] === '1';
+        if (!forceLocal) {
+            const remoteHosts = remoteFeedHostsToDial(opts.host, self);
+            if (!opts.host?.length || (remoteHosts && remoteHosts.length > 0)) {
+                const remote = await gatherRemoteAgentsJson({
+                    // Bare --json stays a block array so older peers and scripts keep working.
+                    args: ['feed', '--json'],
+                    noFanoutEnv: FEED_NO_FANOUT_ENV,
+                    hosts: remoteHosts,
+                    parse: parseRemoteFeed,
+                });
+                blocks = mergeFeedBlocks(localBlocks, remote.items);
+            }
+        }
+        // Fill missing ticket/PR/worktree from live session meta so outcome keys
+        // land even when the publish hook had no deliverable stamp.
+        if (sessions.length > 0) {
+            blocks = enrichBlocksFromSessions(blocks, sessionHintsFromActive(sessions));
+        }
+        // Stall suppression (RUSH-1477): auto-answer "should I…?" / "what's next?"
+        // so they never render. Applied on every feed read unless --all; --dispatch
+        // also applies so unattended ticks drain the stall backlog.
+        const filter = filterBlocksForFeed(blocks, {
+            apply: !opts.all || opts.dispatch === true,
+        });
+        if (!opts.all) {
+            blocks = filter.surfaced;
+        }
+        const digest = suppressionDigest(filter);
+        if (digest && !opts.json) {
+            console.log(chalk.dim(digest));
+        }
+        if (opts.dispatch) {
+            const policy = loadPolicy();
+            const now = new Date();
+            for (const b of blocks) {
+                const result = applyPolicyToBlock(b, policy, now);
+                if (result.action !== 'none') {
+                    console.log(`${chalk.yellow('policy')} ${b.blockId}: ${result.action}`);
+                }
+                if (isPhoneUrgent(b, policy)) {
+                    const notifyResult = await notifyUrgentBlock(b, { dryRun: opts.json });
+                    if (notifyResult.ok && !notifyResult.skipped) {
+                        recordNotified(b.blockId);
+                        console.log(`${chalk.green('notified')} ${b.blockId}`);
+                    }
+                    else if (notifyResult.error) {
+                        console.error(chalk.yellow(`Notification failed for ${b.blockId}: ${notifyResult.error}`));
+                    }
+                }
+            }
+        }
+        for (const warning of setupWarnings) {
+            console.error(chalk.yellow(`Feed hook setup warning: ${warning}`));
+        }
+        if (opts.json) {
+            // Always a block array (stamped with outcome + ask class) so remote fan-out
+            // and scripts keep a stable contract. Human grouping is text-only.
+            const stamped = stampBlockOutcomes(blocks).map((b) => ({
+                ...b,
+                ask: classifyBlock(b),
+            }));
+            console.log(JSON.stringify(stamped, null, 2));
+            return;
+        }
+        if (blocks.length === 0) {
+            console.log(chalk.gray(digest ? 'No open blocks after stall suppression.' : 'No open blocks.'));
+            return;
+        }
+        if (opts.flat) {
+            console.log(chalk.bold(`${blocks.length} open block${blocks.length === 1 ? '' : 's'}:\n`));
+            for (const b of blocks)
+                renderBlock(b, self);
+            return;
+        }
+        const groups = groupBlocksByOutcome(blocks);
+        const openOutcomes = groups.filter((g) => g.counts.open > 0).length;
+        console.log(chalk.bold(`${groups.length} outcome${groups.length === 1 ? '' : 's'} · ${blocks.length} block${blocks.length === 1 ? '' : 's'}` +
+            (openOutcomes > 0 ? ` · ${openOutcomes} need you` : '') +
+            ':\n'));
+        for (const g of groups)
+            renderOutcomeGroup(g, self);
+    });
+}

package/dist/commands/logs.d.ts

@@ -1,10 +1,14 @@
 /**
- * `agents logs` — unified, discoverable run-log viewer.
+ * `agents logs` — unified, discoverable run-log viewer + audit trail.
  *
  * Resolves a run across two substrates and shows (or `-f` follows) its log:
  *  - host-dispatch tasks (`agents run --host`) → combined-stdout log, offset-tailed
  *  - sessions (the local index) → transcript, tailed via the sessions tailer
  *
+ * Subcommands:
+ *  - `agents logs audit` — read the structured audit/event log
+ *  - `agents logs stats` — show aggregate audit statistics
+ *
  * Concise by default: a bare `agents logs <id>` prints the same summary digest as
  * `agents sessions <id>` — cheap for an agent to glance at. The token-heavy full
  * transcript / raw stdout is opt-in behind `--full` (alias `-m/--markdown`).